Who actually looks at your SOC 2 evidence?
- The people who review your SOC 2 evidence can be junior staff, contractors or a team in another country, and you may never be told who they are.
- The CPA profession's ethics code says your auditor should tell you, preferably in writing, before sharing your confidential information with an outside company the firm brings in to help. If you object, they should drop that company or turn down your audit.
- Public company audits have a filing that names the partner who led the audit and any other audit firm that did 5% or more of the work. SOC 2 has nothing like it, so the only way to know is to ask.
- Before you sign, ask who will review your evidence, what they've audited, who outside the firm will see your data and where, and which AI tools will touch it. Get the answers in writing.
When you buy a SOC 2 audit, you meet a few people. Someone walks you through the proposal. Maybe a partner joins the kickoff call. Then you upload your evidence, and it goes into a process you can't see.
Think about what's in that upload: who has admin access to your systems, how your network is laid out, your vulnerability scans, HR records on who joined and who left. It's one of the most sensitive sets of files you'll hand any vendor, so it's fair to ask who opens it.
Your evidence often goes to people you never meet
A SOC 2 report is issued in the audit firm's name, and one engagement lead, the person accountable for your audit, stands behind it. Under that person, a team usually does the work. Who's on that team, and how far they sit from the person you met, varies from firm to firm.
At a large firm, an audit usually runs as a pyramid. A partner signs. A manager runs the audit day to day. Senior staff and junior associates, some a year or two out of school, do most of the testing. The partner you met in the pitch is accountable for the report and often spends the least time on your file. With strong reviewers, that works. It also means the first person to judge your evidence may be in their first year on the job. Whether you need a firm that size at all is its own question.
Then there's outsourcing. The Journal of Accountancy, published by the AICPA (the professional body for CPAs in the US), describes CPA firms outsourcing to reach "a bigger, even international, talent pool," with work "performed domestically or offshore." On SOC 2 specifically, it reported in 2026 that some compliance software vendors have built networks of accounting firms, "often smaller ones, and sometimes with overseas operations," to do the audits.
All of that is allowed, and the firm stays "ultimately responsible" for anything it outsources, in the Journal's words. But it does mean your evidence can end up with people you were never told about, including in other countries.
The ethics code says your auditor should tell you first
The AICPA's ethics rulebook, the Code of Professional Conduct, covers this directly. Before your auditor shares your confidential information with an outside service provider (another company or contractor the firm brings in to help), they should tell you, preferably in writing, that they may use one. If you object, they should either drop that provider or turn down the audit. That's section ET 1.150.040 of the code, if you want to look it up.
They should also do one of two things first: sign a confidentiality agreement with the provider and be reasonably sure it has procedures that keep your information from leaking, or get your specific consent (ET 1.700.040). And they have to plan and supervise the provider's work (ET 1.300.040). "Should" carries weight in that code. A CPA who departs from that guidance has to justify it in any disciplinary hearing.
Two details matter. The rule doesn't require notice for administrative help, like record storage or software hosting. And it only asks the firm to tell you that it may use a provider. The firm doesn't have to name the provider or say where it's based.
So look for that sentence in your engagement letter, the contract that sets the terms of your audit. If it's there, ask who and where. If it isn't, ask whether anyone outside the firm will see your data.
Nothing public shows who worked on your SOC 2
Public company audits are different. Their regulator, the PCAOB, requires a filing called Form AP that names the partner who led the audit and every other audit firm that did 5% or more of the hours, plus where each one is based.
Even that filing has a gap. The PCAOB's own staff guidance says offshore service centers, teams that handle routine audit tasks for a firm, may count as "nonaccounting firms," and their hours go into the total with no name attached.
SOC 2 has no filing like that at all. If you want to know who will work on your audit, ask before you sign.
AI tools can see your evidence too
Your evidence may also pass through AI tools, at the firm or at any company it works with. The Journal of Accountancy puts the stakes plainly: entering data into a generative AI tool means "sharing that data with the AI tool's owners." Some public tools also train future models on whatever people type into them.
AI can make an audit faster and more thorough, and I use it every day. But no professional standard specifically requires an auditor to tell you when they use it on your file, so ask which tools they use, under what agreement, and whether those tools are set up so they don't train on your data.
Six questions get you names before you sign
Here's what I'd ask any firm, mine included.
| Question | A good answer sounds like |
|---|---|
| Who will personally review my evidence and make the judgment calls? | Names and roles, including how much of the testing the person you're talking to does themselves. |
| What have they audited before? | SOC 2 audits they led, at companies like yours. You can check their license yourself. |
| Will anyone outside your firm see my data? | A plain yes or no. If yes, who, what they do and which country. |
| Where will my evidence be stored? | A named provider and a country. |
| Which AI tools will touch my evidence? | Named tools, under an agreement that keeps them from training on your data. |
| Will you put that in writing? | Yes, in the engagement letter or the terms it points to. |
If the person on the call can't name the team yet, ask when you'll get names, and ask for that in writing too. I also wrote about what happens to your evidence before anyone reviews it: who decides what gets collected.
We hold our own audits to the same list
Here are our answers. A licensed auditor makes every judgment call on a client's evidence. Every outside company that handles client data for us is named, with what it does, in our data processing addendum, the privacy terms anyone can read before signing. That includes the AI providers, which are set up so they don't train on customer content. Client data is processed in the United States. All of it is in writing, in an addendum that's part of the terms every client accepts.
Whoever you hire, send them these six questions before you sign, and keep their answers with your contract.
Frequently asked questions
Do SOC 2 auditors outsource work offshore?
Does my auditor have to tell me if they share my data with a third party?
Who actually performs a SOC 2 audit?
Can I find out who worked on my SOC 2 audit?
Does my SOC 2 auditor have to tell me if they use AI on my data?
Keep reading
Is there a SOC 2 platform that includes the audit?
Yes, and Chiaro is one. What the price covers, who signs the report, and five questions to ask any bundle.
What does AI-native SOC 2 actually mean?
A practical test for AI-native claims: what your AI can finish, what you still do, and who checks the result.
How much should a solo founder pay for SOC 2 in 2026?
SOC 2 cost for a team under five: readiness, the audit and the final report. Transparent prices and real audit work.
Do you need an evidence collection tool?
Nothing in the standards requires one. Evidence is records your systems already produce, and the auditor should be the one collecting them.
Sources
- AICPA Code of Professional Conduct: ET 1.150.040 (tell the client, preferably in writing, before sharing confidential information with a third-party service provider; administrative support is exempt), ET 1.700.040 (a confidentiality agreement plus reasonable assurance of the provider's safeguards, or the client's specific consent), ET 1.300.040 (plan and supervise the provider's work) and 0.100.020 (a member who departs from an interpretation must justify it in any disciplinary hearing).
- CPA firms outsource to reach a bigger, even international, talent pool; work may be performed domestically or offshore, and the firm remains ultimately responsible for it.
- Some SOC tool vendors have cultivated networks of accounting firms, often smaller ones and sometimes with overseas operations, to complete SOC 2 examinations.
- Form AP names the engagement partner and each other accounting firm contributing 5% or more of total audit hours; offshore service centers may be nonaccounting firms, which are not identified on the form.
- Entering data into a generative AI tool shares that data with the tool's owners.
- Some publicly available generative AI tools use inputs to train future models, and CPAs in public practice should check whether client consent is required before putting client data into an AI system.
- No specific federal law or professional standard applicable to CPAs mandates disclosure when generative AI is used on client data.